@nowcrew/daemon 0.6.11 → 0.6.13

package/dist/remote/identity.js

@@ -0,0 +1,39 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+import { REMOTE_PROTOCOL_VERSION } from "./protocol.js";
+const Base64Url32Schema = z.string().regex(/^[A-Za-z0-9_-]{43}$/);
+export const GatewayIdentitySchema = z.object({
+    gatewayId: z.string().uuid(),
+    pid: z.number().int().positive(),
+    protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    proof: Base64Url32Schema,
+}).strict();
+export function createIdentitySecret() {
+    return randomBytes(32).toString("base64url");
+}
+export function createIdentityNonce() {
+    return randomBytes(32).toString("base64url");
+}
+export function signGatewayIdentity(identityKey, nonce, identity) {
+    const key = Base64Url32Schema.parse(identityKey);
+    const parsedNonce = Base64Url32Schema.parse(nonce);
+    return createHmac("sha256", Buffer.from(key, "base64url"))
+        .update(JSON.stringify([
+        "nowcrew.remote.identity.v1",
+        parsedNonce,
+        identity.gatewayId,
+        identity.pid,
+        identity.protocolVersion,
+    ]))
+        .digest("base64url");
+}
+export function verifyGatewayIdentity(identityKey, nonce, identity) {
+    try {
+        const expected = Buffer.from(signGatewayIdentity(identityKey, nonce, identity), "base64url");
+        const actual = Buffer.from(identity.proof, "base64url");
+        return expected.length === actual.length && timingSafeEqual(expected, actual);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/remote/owner.js

@@ -0,0 +1,77 @@
+import { randomUUID } from "node:crypto";
+import { acquireRemoteOwnerLock, readRemoteOwnerLock, releaseRemoteOwnerLock, } from "./config.js";
+import { createIdentityNonce, createIdentitySecret, GatewayIdentitySchema, verifyGatewayIdentity, } from "./identity.js";
+function ownerBaseUrl(lock) {
+    const host = lock.host === "0.0.0.0" || lock.host === "::" ? "127.0.0.1" : lock.host;
+    return `http://${host}:${lock.port}`;
+}
+export function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+export async function authenticateRemoteGateway(config) {
+    let lock;
+    try {
+        lock = await readRemoteOwnerLock(config.paths.lock);
+    }
+    catch {
+        return null;
+    }
+    if (!lock?.identityKey)
+        return null;
+    const nonce = createIdentityNonce();
+    try {
+        const response = await fetch(`${ownerBaseUrl(lock)}/api/v1/identity?nonce=${encodeURIComponent(nonce)}`, {
+            signal: AbortSignal.timeout(700),
+        });
+        if (!response.ok)
+            return null;
+        const identity = GatewayIdentitySchema.parse(await response.json());
+        if (identity.gatewayId !== lock.gatewayId || identity.pid !== lock.pid)
+            return null;
+        if (!verifyGatewayIdentity(lock.identityKey, nonce, identity))
+            return null;
+        return {
+            gatewayId: identity.gatewayId,
+            pid: identity.pid,
+            protocolVersion: identity.protocolVersion,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function acquireGatewayOwnership(config, options = {}) {
+    const attempts = options.attempts ?? 50;
+    const intervalMs = options.intervalMs ?? 100;
+    const candidate = {
+        version: 1,
+        gatewayId: randomUUID(),
+        pid: process.pid,
+        host: config.host,
+        port: config.port,
+        startedAt: new Date().toISOString(),
+        identityKey: createIdentitySecret(),
+    };
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+        if (await acquireRemoteOwnerLock(config.paths.lock, candidate)) {
+            return { kind: "acquired", lock: candidate };
+        }
+        const identity = await authenticateRemoteGateway(config);
+        if (identity)
+            return { kind: "existing", identity };
+        const current = await readRemoteOwnerLock(config.paths.lock).catch(() => null);
+        if (current && !isProcessAlive(current.pid)) {
+            await releaseRemoteOwnerLock(config.paths.lock, current.gatewayId);
+            continue;
+        }
+        if (attempt + 1 < attempts)
+            await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+    throw new Error("NowCrew remote gateway owner exists but could not be authenticated");
+}

package/dist/remote/protocol.js

@@ -0,0 +1,211 @@
+import { z } from "zod";
+export const REMOTE_PROTOCOL_VERSION = 2;
+export const MAX_REMOTE_PROMPT_BYTES = 64 * 1024;
+export const MAX_CLAUDE_INPUT_QUEUE_ITEMS = 16;
+export const MAX_CLAUDE_INPUT_QUEUE_BYTES = 1024 * 1024;
+export const MAX_REMOTE_WEBSOCKET_BUFFER_BYTES = 1024 * 1024;
+export const RemoteRuntimeSchema = z.enum(["claude", "codex"]);
+export const RemoteControlStateSchema = z.enum([
+    "live",
+    "read_only",
+    "offline",
+    "unsupported",
+]);
+export const RemoteSessionSourceSchema = z.enum(["channel", "app_server", "history"]);
+export const RemoteSessionSummarySchema = z.object({
+    id: z.string().min(1).max(128),
+    runtime: RemoteRuntimeSchema,
+    title: z.string().min(1).max(240),
+    cwd: z.string().max(4096),
+    updatedAt: z.string().datetime(),
+    controlState: RemoteControlStateSchema,
+    busy: z.boolean(),
+    source: RemoteSessionSourceSchema,
+}).strict();
+const TimelineBaseSchema = z.object({
+    id: z.string().min(1).max(256),
+    createdAt: z.string().datetime(),
+});
+export const RemoteQuestionsSchema = z.array(z.object({
+    id: z.string().min(1).max(160),
+    header: z.string().max(160),
+    question: z.string().min(1).max(4_000),
+    isSecret: z.boolean(),
+    options: z.array(z.object({
+        label: z.string().min(1).max(240),
+        description: z.string().max(1_000),
+    }).strict()).max(32).nullable(),
+}).strict()).min(1).max(4);
+export const RemoteTimelineItemSchema = z.discriminatedUnion("kind", [
+    TimelineBaseSchema.extend({
+        kind: z.literal("message"),
+        role: z.enum(["user", "assistant"]),
+        text: z.string().min(1),
+    }).strict(),
+    TimelineBaseSchema.extend({
+        kind: z.literal("tool"),
+        name: z.string().min(1).max(160),
+        summary: z.string().max(12_000),
+        status: z.string().min(1).max(80),
+    }).strict(),
+    TimelineBaseSchema.extend({
+        kind: z.literal("approval"),
+        requestId: z.string().min(1).max(160),
+        tool: z.string().min(1).max(160),
+        preview: z.string().max(12_000),
+    }).strict(),
+    TimelineBaseSchema.extend({
+        kind: z.literal("question"),
+        requestId: z.string().uuid(),
+        questions: RemoteQuestionsSchema,
+    }).strict(),
+    TimelineBaseSchema.extend({
+        kind: z.literal("status"),
+        text: z.string().min(1).max(2_000),
+    }).strict(),
+]);
+export const SubmitRemoteInputSchema = z.object({
+    text: z.string().trim().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= MAX_REMOTE_PROMPT_BYTES, `prompt must not exceed ${MAX_REMOTE_PROMPT_BYTES} UTF-8 bytes`),
+    idempotencyKey: z.string().uuid(),
+}).strict();
+export const ResolveRemoteApprovalSchema = z.object({
+    decision: z.enum(["allow", "deny"]),
+}).strict();
+export const ResolveRemoteQuestionSchema = z.object({
+    answers: z.record(z.array(z.string().max(4_000)).max(16)),
+}).strict();
+export const ChannelRegistrationSchema = z.object({
+    type: z.literal("channel.register"),
+    protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    sessionId: z.string().uuid(),
+    cwd: z.string().min(1).max(4096),
+    pid: z.number().int().positive(),
+    generation: z.string().uuid(),
+    title: z.string().min(1).max(240).optional(),
+}).strict();
+export const ChannelReplySchema = z.object({
+    type: z.literal("channel.reply"),
+    protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    sessionId: z.string().uuid(),
+    requestId: z.string().uuid(),
+    text: z.string().max(200_000),
+}).strict();
+export const BridgeUserMessageSchema = z.object({
+    type: z.literal("bridge.user_message"),
+    protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    sessionId: z.string().uuid(),
+    messageId: z.string().uuid(),
+    text: z.string().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= MAX_REMOTE_PROMPT_BYTES, `message must not exceed ${MAX_REMOTE_PROMPT_BYTES} UTF-8 bytes`),
+    createdAt: z.string().datetime(),
+}).strict();
+export const ChannelPermissionRequestSchema = z.object({
+    type: z.literal("channel.permission"),
+    protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    sessionId: z.string().uuid(),
+    requestId: z.string().regex(/^[a-km-z]{5}$/),
+    tool: z.string().min(1).max(160),
+    description: z.string().max(4_000),
+    preview: z.string().max(16_000),
+}).strict();
+export const BridgeApprovalRequestSchema = z.object({
+    type: z.literal("bridge.approval"),
+    protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    sessionId: z.string().uuid(),
+    requestId: z.string().uuid(),
+    tool: z.string().min(1).max(160),
+    preview: z.string().max(16_000),
+}).strict();
+export const BridgeQuestionRequestSchema = z.object({
+    type: z.literal("bridge.question"),
+    protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    sessionId: z.string().uuid(),
+    requestId: z.string().uuid(),
+    questions: RemoteQuestionsSchema,
+}).strict();
+export const BridgeStatusSchema = z.object({
+    type: z.literal("bridge.status"),
+    protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    sessionId: z.string().uuid(),
+    busy: z.boolean(),
+}).strict();
+export const BridgeResolvedSchema = z.object({
+    type: z.literal("bridge.resolved"),
+    protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    sessionId: z.string().uuid(),
+    requestId: z.string().uuid(),
+}).strict();
+export const ChannelDeliveryAckSchema = z.object({
+    type: z.literal("channel.delivery_ack"),
+    protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    sessionId: z.string().uuid(),
+    generation: z.string().uuid(),
+    deliveryId: z.string().uuid(),
+    status: z.enum(["accepted", "queue_full", "not_pending"]),
+}).strict();
+export const ChannelToGatewaySchema = z.discriminatedUnion("type", [
+    ChannelRegistrationSchema,
+    ChannelReplySchema,
+    BridgeUserMessageSchema,
+    ChannelPermissionRequestSchema,
+    BridgeApprovalRequestSchema,
+    BridgeQuestionRequestSchema,
+    BridgeStatusSchema,
+    BridgeResolvedSchema,
+    ChannelDeliveryAckSchema,
+]);
+export const GatewayToChannelSchema = z.discriminatedUnion("type", [
+    z.object({
+        type: z.literal("channel.registered"),
+        protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+        sessionId: z.string().uuid(),
+        generation: z.string().uuid(),
+    }).strict(),
+    z.object({
+        type: z.literal("channel.prompt"),
+        protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+        deliveryId: z.string().uuid(),
+        requestId: z.string().uuid(),
+        text: z.string().min(1).max(MAX_REMOTE_PROMPT_BYTES),
+    }).strict(),
+    z.object({
+        type: z.literal("bridge.approval_response"),
+        protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+        deliveryId: z.string().uuid(),
+        requestId: z.string().uuid(),
+        decision: z.enum(["allow", "deny"]),
+    }).strict(),
+    z.object({
+        type: z.literal("bridge.question_response"),
+        protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+        deliveryId: z.string().uuid(),
+        requestId: z.string().uuid(),
+        answers: ResolveRemoteQuestionSchema.shape.answers,
+    }).strict(),
+    z.object({
+        type: z.literal("channel.permission_response"),
+        protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+        deliveryId: z.string().uuid(),
+        requestId: z.string().regex(/^[a-km-z]{5}$/),
+        decision: z.enum(["allow", "deny"]),
+    }).strict(),
+]);
+export const GatewayClientEventSchema = z.discriminatedUnion("type", [
+    z.object({
+        type: z.literal("sessions.changed"),
+        protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+    }).strict(),
+    z.object({
+        type: z.literal("timeline.appended"),
+        protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+        runtime: RemoteRuntimeSchema,
+        sessionId: z.string().min(1).max(128),
+        item: RemoteTimelineItemSchema,
+    }).strict(),
+    z.object({
+        type: z.literal("interaction.resolved"),
+        protocolVersion: z.literal(REMOTE_PROTOCOL_VERSION),
+        runtime: RemoteRuntimeSchema,
+        sessionId: z.string().min(1).max(128),
+        requestId: z.string().min(1).max(160),
+    }).strict(),
+]);

package/dist/remote/remote-cli.js

@@ -0,0 +1,254 @@
+import { createRequire } from "node:module";
+import { networkInterfaces } from "node:os";
+import { dirname, join } from "node:path";
+import { statSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+import spawn from "cross-spawn";
+import { runClaudeBridge } from "./claude-bridge.js";
+import { loadOrCreateRemoteConfig, releaseRemoteOwnerLock, updateRemoteBinding, } from "./config.js";
+import { startRemoteGateway } from "./gateway.js";
+import { startCodexRuntime } from "./codex-runtime.js";
+import { acquireGatewayOwnership, authenticateRemoteGateway } from "./owner.js";
+import { buildCodexWrappedInvocation } from "./wrapper.js";
+import { probeRuntime, } from "./runtime-probe.js";
+function existingDirectory(path) {
+    try {
+        return statSync(path).isDirectory() ? path : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function bundledUiDir() {
+    const embedded = existingDirectory(join(dirname(fileURLToPath(import.meta.url)), "..", "remote-web"));
+    if (embedded)
+        return embedded;
+    try {
+        const require = createRequire(import.meta.url);
+        return existingDirectory(join(dirname(require.resolve("@nowcrew/remote-web/package.json")), "dist"));
+    }
+    catch {
+        return null;
+    }
+}
+function displayHost(host) {
+    if (host !== "0.0.0.0" && host !== "::")
+        return host;
+    for (const values of Object.values(networkInterfaces())) {
+        const address = values?.find((value) => value.family === "IPv4" && !value.internal)?.address;
+        if (address)
+            return address;
+    }
+    return "127.0.0.1";
+}
+function baseUrl(config) {
+    return `http://${displayHost(config.host)}:${config.port}`;
+}
+function localBaseUrl(config) {
+    const host = config.host === "0.0.0.0" || config.host === "::" ? "127.0.0.1" : config.host;
+    return `http://${host}:${config.port}`;
+}
+function pairingUrl(config) {
+    return `${baseUrl(config)}/#token=${encodeURIComponent(config.token)}`;
+}
+function currentDaemonInvocation() {
+    const entry = process.argv[1];
+    if (!entry)
+        throw new Error("Unable to locate the crew-daemon entrypoint");
+    return { command: process.execPath, args: [...process.execArgv, entry] };
+}
+function spawnAndWait(bin, args, env) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(bin, [...args], { env, stdio: "inherit" });
+        child.once("error", reject);
+        child.once("close", (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+    });
+}
+function reportDegradedRuntime(result) {
+    if (result.state === "supported")
+        return;
+    process.stderr.write(`NowCrew remote: ${result.runtime} live control ${result.state}: ${result.reason}\n`);
+}
+async function ensureGateway(config) {
+    if (await authenticateRemoteGateway(config))
+        return;
+    const invocation = currentDaemonInvocation();
+    const child = spawn(invocation.command, [...invocation.args, "remote", "serve", "--background"], {
+        env: process.env,
+        detached: true,
+        stdio: "ignore",
+    });
+    child.unref();
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+        await new Promise((resolve) => setTimeout(resolve, 100));
+        if (await authenticateRemoteGateway(config))
+            return;
+    }
+    throw new Error(`NowCrew remote gateway did not start at ${localBaseUrl(config)}`);
+}
+function usage() {
+    return [
+        "NowCrew mobile runtime control:",
+        "  crew-daemon remote setup [--host 127.0.0.1|0.0.0.0] [--port 4317]",
+        "  crew-daemon remote serve [--host ...] [--port ...] [--ui-dir <path>]",
+        "  crew-daemon remote status|url",
+        "  crew-daemon remote run claude -- [claude options]",
+        "  crew-daemon remote run codex -- [codex options]",
+    ].join("\n") + "\n";
+}
+async function serveCommand(argv) {
+    const parsed = parseArgs({
+        args: [...argv],
+        strict: true,
+        options: {
+            host: { type: "string" },
+            port: { type: "string" },
+            "ui-dir": { type: "string" },
+            background: { type: "boolean", default: false },
+        },
+    });
+    const port = parsed.values.port === undefined ? undefined : Number(parsed.values.port);
+    const config = await loadOrCreateRemoteConfig({
+        ...(parsed.values.host === undefined ? {} : { host: parsed.values.host }),
+        ...(port === undefined ? {} : { port }),
+    });
+    const ownership = await acquireGatewayOwnership(config);
+    if (ownership.kind === "existing")
+        return 0;
+    const owner = ownership.lock;
+    if (!owner.identityKey)
+        throw new Error("New remote gateway owner is missing its identity key");
+    let codexRuntime = null;
+    try {
+        const [claudeProbe, codexProbe] = await Promise.all([
+            probeRuntime("claude"),
+            probeRuntime("codex"),
+        ]);
+        reportDegradedRuntime(claudeProbe);
+        reportDegradedRuntime(codexProbe);
+        const runtimeStates = {
+            ...(claudeProbe.state === "supported" ? {} : { claude: claudeProbe.state }),
+            ...(codexProbe.state === "supported" ? {} : { codex: codexProbe.state }),
+        };
+        if (codexProbe.state === "supported") {
+            codexRuntime = await startCodexRuntime(config.paths.codexSocket).catch((error) => {
+                runtimeStates.codex = "offline";
+                process.stderr.write(`NowCrew remote: Codex live control offline: ${error instanceof Error ? error.message : String(error)}\n`);
+                return null;
+            });
+        }
+        let gateway = null;
+        try {
+            gateway = await startRemoteGateway({
+                config,
+                gatewayId: owner.gatewayId,
+                identityKey: owner.identityKey,
+                ...(codexRuntime === null ? {} : { codex: codexRuntime.adapter }),
+                runtimeStates,
+                uiDir: parsed.values["ui-dir"] ?? process.env.NOWCREW_REMOTE_UI_DIR ?? bundledUiDir(),
+            });
+            if (!parsed.values.background)
+                process.stdout.write(`NowCrew remote listening at ${baseUrl(config)}\n`);
+            await new Promise((resolve) => {
+                process.once("SIGINT", resolve);
+                process.once("SIGTERM", resolve);
+            });
+        }
+        finally {
+            await gateway?.close();
+        }
+    }
+    finally {
+        try {
+            await codexRuntime?.close();
+        }
+        finally {
+            await releaseRemoteOwnerLock(config.paths.lock, owner.gatewayId);
+        }
+    }
+    return 0;
+}
+async function setupCommand(argv) {
+    const parsed = parseArgs({
+        args: [...argv],
+        strict: true,
+        options: {
+            host: { type: "string" },
+            port: { type: "string" },
+            help: { type: "boolean", short: "h", default: false },
+        },
+    });
+    if (parsed.values.help) {
+        process.stdout.write(usage());
+        return 0;
+    }
+    let config = await loadOrCreateRemoteConfig();
+    if (parsed.values.host !== undefined || parsed.values.port !== undefined) {
+        config = await updateRemoteBinding(config, {
+            host: parsed.values.host ?? config.host,
+            port: parsed.values.port === undefined ? config.port : Number(parsed.values.port),
+        });
+    }
+    process.stdout.write([
+        `Phone URL: ${pairingUrl(config)}`,
+        "",
+        "Add these shell functions to your zsh configuration:",
+        "claude() { crew-daemon remote run claude -- \"$@\"; }",
+        "codex() { crew-daemon remote run codex -- \"$@\"; }",
+        "",
+        config.host === "127.0.0.1"
+            ? "Loopback mode is enabled. Use --host 0.0.0.0 for a trusted LAN, or expose this URL through private HTTPS."
+            : "LAN mode is enabled. Keep the capability URL private and do not expose this HTTP port to the public internet.",
+    ].join("\n") + "\n");
+    return 0;
+}
+export async function runRemoteCommand(argv) {
+    if (argv[0] !== "remote")
+        return null;
+    const action = argv[1];
+    if (!action || action === "help" || action === "--help" || action === "-h") {
+        process.stdout.write(usage());
+        return 0;
+    }
+    if (action === "serve")
+        return serveCommand(argv.slice(2));
+    if (action === "setup")
+        return setupCommand(argv.slice(2));
+    const config = await loadOrCreateRemoteConfig();
+    if (action === "status") {
+        const current = await authenticateRemoteGateway(config);
+        process.stdout.write(`${JSON.stringify({
+            running: current !== null,
+            url: baseUrl(config),
+            ...(current ?? {}),
+        }, null, 2)}\n`);
+        return current ? 0 : 3;
+    }
+    if (action === "url") {
+        process.stdout.write(`${pairingUrl(config)}\n`);
+        return 0;
+    }
+    if (action !== "run" || !["claude", "codex"].includes(argv[2] ?? "")) {
+        process.stderr.write(usage());
+        return 2;
+    }
+    const runtime = argv[2];
+    const probe = await probeRuntime(runtime);
+    if (probe.state !== "supported") {
+        reportDegradedRuntime(probe);
+        return 4;
+    }
+    await ensureGateway(config);
+    const separator = argv.indexOf("--", 3);
+    const runtimeArgs = argv.slice(separator >= 0 ? separator + 1 : 3);
+    if (runtime === "claude") {
+        return runClaudeBridge(runtimeArgs, {
+            gatewayUrl: localBaseUrl(config),
+            token: config.token,
+            cwd: process.cwd(),
+        });
+    }
+    const invocation = buildCodexWrappedInvocation(runtimeArgs, config.paths.codexSocket, process.env.NOWCREW_CODEX_BIN ?? "codex");
+    return spawnAndWait(invocation.bin, invocation.args, invocation.env);
+}